Practical Related-Key Forgery Attacks on Full-Round TinyJAMBU-192/256
TinyJAMBU is one of the finalists in the NIST lightweight cryptography competition. It is considered to be one of the more efficient ciphers in the competition and has undergone extensive analysis in recent years as both the keyed permutation as well as the mode are new designs. In this paper we pr...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Ruhr-Universität Bochum
2023-06-01
|
| Series: | IACR Transactions on Symmetric Cryptology |
| Subjects: | |
| Online Access: | https://tosc.iacr.org/index.php/ToSC/article/view/10982 |
| _version_ | 1797801933641089024 |
|---|---|
| author | Orr Dunkelman Shibam Ghosh Eran Lambooij |
| author_facet | Orr Dunkelman Shibam Ghosh Eran Lambooij |
| author_sort | Orr Dunkelman |
| collection | DOAJ |
| description |
TinyJAMBU is one of the finalists in the NIST lightweight cryptography competition. It is considered to be one of the more efficient ciphers in the competition and has undergone extensive analysis in recent years as both the keyed permutation as well as the mode are new designs. In this paper we present a related-key forgery attack on the updated TinyJAMBU-v2 scheme with 256- and 192-bit keys. We introduce a high probability related-key differential attack where the differences are only introduced into the key state. Therefore, the characteristic is applicable to the TinyJAMBU mode and can be used to mount a forgery attack. The time and data complexity of the forgery are 233 using 214 related-keys for the 256-bit key version, and 243 using 216 related-keys for the 192-bit key version.
For the 128-bit key we construct a related-key differential characteristic on the full keyed permutation of TinyJAMBU with a probability of 2−16. We extend the relatedkey differential characteristics on TinyJAMBU to practical-time key-recovery attacks that extract the full key from the keyed permutation with a time and data complexity of 224, 221, and 219 for respectively the 128-, 192-, and 256-bit key variants.
All characteristics are experimentally verified and we provide key nonce pairs that produce the same tag to show the feasibility of the forgery attack. We note that the designers do not claim related-key security, however, the attacks proposed in this paper suggest that the scheme is not key-commiting, which has been recently identified as a favorable property for AEAD schemes.
|
| first_indexed | 2024-03-13T04:58:05Z |
| format | Article |
| id | doaj.art-c86d61690e2a4257b19865eec76b214e |
| institution | Directory Open Access Journal |
| issn | 2519-173X |
| language | English |
| last_indexed | 2024-03-13T04:58:05Z |
| publishDate | 2023-06-01 |
| publisher | Ruhr-Universität Bochum |
| record_format | Article |
| series | IACR Transactions on Symmetric Cryptology |
| spelling | doaj.art-c86d61690e2a4257b19865eec76b214e2023-06-17T15:51:15ZengRuhr-Universität BochumIACR Transactions on Symmetric Cryptology2519-173X2023-06-012023210.46586/tosc.v2023.i2.176-188Practical Related-Key Forgery Attacks on Full-Round TinyJAMBU-192/256Orr Dunkelman0Shibam Ghosh1Eran Lambooij2Department of Computer Science, University Of Haifa, Haifa, IsraelDepartment of Computer Science, University Of Haifa, Haifa, IsraelDepartment of Computer Science, University Of Haifa, Haifa, Israel TinyJAMBU is one of the finalists in the NIST lightweight cryptography competition. It is considered to be one of the more efficient ciphers in the competition and has undergone extensive analysis in recent years as both the keyed permutation as well as the mode are new designs. In this paper we present a related-key forgery attack on the updated TinyJAMBU-v2 scheme with 256- and 192-bit keys. We introduce a high probability related-key differential attack where the differences are only introduced into the key state. Therefore, the characteristic is applicable to the TinyJAMBU mode and can be used to mount a forgery attack. The time and data complexity of the forgery are 233 using 214 related-keys for the 256-bit key version, and 243 using 216 related-keys for the 192-bit key version. For the 128-bit key we construct a related-key differential characteristic on the full keyed permutation of TinyJAMBU with a probability of 2−16. We extend the relatedkey differential characteristics on TinyJAMBU to practical-time key-recovery attacks that extract the full key from the keyed permutation with a time and data complexity of 224, 221, and 219 for respectively the 128-, 192-, and 256-bit key variants. All characteristics are experimentally verified and we provide key nonce pairs that produce the same tag to show the feasibility of the forgery attack. We note that the designers do not claim related-key security, however, the attacks proposed in this paper suggest that the scheme is not key-commiting, which has been recently identified as a favorable property for AEAD schemes. https://tosc.iacr.org/index.php/ToSC/article/view/10982TinyJAMBUDifferential cryptanalysisRelated-KeyForgeryNIST-LWC |
| spellingShingle | Orr Dunkelman Shibam Ghosh Eran Lambooij Practical Related-Key Forgery Attacks on Full-Round TinyJAMBU-192/256 IACR Transactions on Symmetric Cryptology TinyJAMBU Differential cryptanalysis Related-Key Forgery NIST-LWC |
| title | Practical Related-Key Forgery Attacks on Full-Round TinyJAMBU-192/256 |
| title_full | Practical Related-Key Forgery Attacks on Full-Round TinyJAMBU-192/256 |
| title_fullStr | Practical Related-Key Forgery Attacks on Full-Round TinyJAMBU-192/256 |
| title_full_unstemmed | Practical Related-Key Forgery Attacks on Full-Round TinyJAMBU-192/256 |
| title_short | Practical Related-Key Forgery Attacks on Full-Round TinyJAMBU-192/256 |
| title_sort | practical related key forgery attacks on full round tinyjambu 192 256 |
| topic | TinyJAMBU Differential cryptanalysis Related-Key Forgery NIST-LWC |
| url | https://tosc.iacr.org/index.php/ToSC/article/view/10982 |
| work_keys_str_mv | AT orrdunkelman practicalrelatedkeyforgeryattacksonfullroundtinyjambu192256 AT shibamghosh practicalrelatedkeyforgeryattacksonfullroundtinyjambu192256 AT eranlambooij practicalrelatedkeyforgeryattacksonfullroundtinyjambu192256 |